Important: java-17-openjdk security and bug fix update
Summary
ALSA-2023:1879: Important: java-17-openjdk security and bug fix update. Affects java-17-openjdk versions < 1:17.0.7.0.7-1.el9_1. Fixed in 1:17.0.7.0.7-1.el9_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The java-17-openjdk packages provide the OpenJDK 17 Java Runtime Environment and the OpenJDK 17 Java Software Development Kit. These packages are used for running Java applications and developing Java software. OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It is widely used in various applications and platforms.
Vulnerability Detail
This update addresses multiple security vulnerabilities in the java-17-openjdk packages:
-
CVE-2023-21930: This vulnerability relates to improper connection handling during the TLS handshake. An attacker could exploit this vulnerability to perform man-in-the-middle attacks and intercept sensitive information.
-
CVE-2023-21939: This vulnerability is related to a parsing issue in Swing HTML. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2023-21954: This vulnerability is caused by incorrect enqueue of references in the garbage collector. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2023-21967: This vulnerability relates to a certificate validation issue in TLS session negotiation. An attacker could exploit this vulnerability to perform man-in-the-middle attacks and intercept sensitive information.
-
CVE-2023-21937: This vulnerability is caused by missing string checks for NULL characters. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2023-21938: This vulnerability is caused by incorrect handling of NULL characters in ProcessBuilder. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
-
CVE-2023-21968: This vulnerability is caused by a missing check for slash characters in URI-to-path conversion. An attacker could exploit this vulnerability to perform directory traversal attacks and access sensitive files.
These vulnerabilities pose a significant risk to the security and integrity of Java applications and systems that use the affected packages.
How To Fix
Minimum fixed version
1:17.0.7.0.7-1.el9_1
This is the first release that contains the fix.
sudo dnf update java-17-openjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
Conclusion
In conclusion, the java-17-openjdk packages are affected by multiple security vulnerabilities that could lead to various attacks and compromises. It is crucial to update the packages to the latest version to mitigate these risks. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for java-17-openjdk →
FAQ
OpenJDK is an open-source implementation of the Java Platform, Standard Edition (Java SE). It provides a Java Runtime Environment (JRE) and a Java Software Development Kit (SDK) for running Java applications and developing Java software.
These vulnerabilities could allow an attacker to perform man-in-the-middle attacks, execute arbitrary code, cause a denial of service, or access sensitive files. It is important to update the affected packages to mitigate these risks.
To update the java-17-openjdk packages, you can use the package manager specific to your operating system. For example, on AlmaLinux 9, you can use the 'dnf' package manager and run the command 'sudo dnf update java-17-openjdk'.
There are no known workarounds for these vulnerabilities. It is recommended to apply the security update as soon as possible.
You can find more information about these vulnerabilities, including their impact, CVSS scores, and related CVE pages, in the References section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for java-17-openjdk.
